PRIVACY AND COOKIE POLICY

INFORMATION OF THE JOINT CONTROLLERS WITH RESPECT TO THE PROCESSING OF PERSONAL DATA

made pursuant to ArBcles 13 and 14 of EU REGULATION No. 2016/679 ("GDPR")

The goal of UCapital24 S.p.A. and UCapital Ltd (the "Companies," the "Joint Controllers," or "we") is to synergis>cally

provide a financial educa>on service (hereinaCer "UCapital Academy") with which it is possible to gain the skills,

knowledge and confidence to succeed as a professional trader and aCer access to a "trading challenge" that allows

people to test their trading skills in financial instruments by opening demo trading accounts, i.e., without the use of

real money, subject to the rules set forth in the general terms and condi>ons of the service. Included in the

subscrip>on is the free registra>on for Market Intelligence, a plaKorm through which you can analyze all financial

markets with ar>ficial intelligence and have access to a porKolio of coded strategies, technical analysis tools, real->me

news and more (for data processing carried out through Market Intelligence, please refer to the relevant Privacy

Policy).

The Joint Controllers have signed a joint controllers agreement, the extract of which is available at their registered

oﬃces, for the purpose of defining, pursuant to Ar>cle 26 of Regula>on (EU) 2016/679 (hereinaCer, "GDPR"), the

processing of personal data carried out under co-ownership for the administra>ve, organiza>onal, accoun>ng and

promo>onal/marke>ng management of the ac>vi>es and services rendered jointly by the two Companies.

The joint Controllers wish to provide the Interested Par>es with certain informa>on regarding the processing of their

personal data, as defined below, which the same may collect and process through the website h\ps://

academy.ucapital.com through which it is possible to find all the informa>on about the Academy and the webapp

h\ps://appacademy.ucapital.com through which it is possible to purchase the service and access the training material,

in the capacity of Users or Customers of the services rendered.

Where not otherwise specified, this Policy applies as a disclosure - pursuant to Ar>cles 13 and 14 of Regula>on (EU)

No. 2016/679 (hereinaCer the "GDPR") - made to those who interact with the above site ("Users", "Interested

Par:es", or "you").

1. Joint data controllers. Data Processors.

In rela>on to personal data collected for the use of services UCapital Academy, the Data Controllers are:

UCapital24 S.p.A., with registered oﬃce at Via dei Piab 11, 20123, Milan (MI), C.F. and P.IVA 10144280962. The

updated list of data processors is available, upon request, at the oﬃces of the Joint Controller.

UCapital Ltd, with registered oﬃce at Salisbury House, 81 High Street, Po\ers Bar, HerKordshire, United Kingdom, EN6

5AS, Company Number: 11107665. The updated list of data processors is available, upon request, at the oﬃce of the

Joint Controller.

The Joint Controllers hold in the highest regard the right to privacy and the protec>on of their Users' personal data.

For any informa>on in connec>on with this privacy policy, Users may contact, as the designated point of contact by the

Joint Controllers themselves, UCapital24 S.p.a.

1However, it remains the right of the Interested Par>es to contact indiﬀerently both Joint Controllers at any >me, using

the following methods:

For UCapital24 S.p.a by wri>ng an e-mail to privacy@ucapital24.com or by sending a registered le\er with return

receipt to the company's registered oﬃce at Via dei Piab 11, 20123, Milan (Mi).

For UCapital Ltd by wri>ng an e-mail to support@academy.ucapital.com or by sending an interna>onal registered

le\er to the company's registered oﬃce at Salisbury House, 81 High Street, Po\ers Bar, HerKordshire, United

Kingdom, EN6 5AS.

2. Data ProtecBon Oﬃcer.

The Joint Controller UCapital24 S.p.A. has appointed a Data Protec>on Oﬃcer ("DPO" or "RDP"), pursuant to Ar>cle 37

of the GDPR, who is responsible for supervising compliance with the legisla>on protec>ng personal data and ac>ng as

a point of contact for data subjects and who can be contacted for any needs inherent to the processing of personal

data by wri>ng to the following e-mail address: dpo@ucapital24.com .

3. Categories of personal data processed, source from which they originate, and why we use Data Subjects' data.

Purposes and legal basis of the processing. Consequences if data is not provided.

Following is a list of all the purposes for which we collect Users' personal data, Purposes and legal basis of processing,

Legi>mate interests pursued.

I da> personali raccol> saranno tra\a>:

a) For website navigaBon and acBviBes related to the funcBoning and operaBon of the web page:

1. Purpose of processing: to enable web browsing and, in case of computer crimes, to ascertain

possible liability.

2. Data processed: The computer systems and soCware procedures responsible for the opera>on of

this web page acquire, in the course of their normal opera>on, some personal data whose

transmission is implicit in the use of Internet communica>on protocols. This category of data

includes IP addresses, domain names, URIs.

3. Legal basis:

i. provision of services aimed at enabling users to navigate this website;

ii. legi>mate interest consis>ng in ensuring the proper func>oning of computer systems and to

proceed with the inves>ga>on of possible crimes (possibly also based on the existence of a

legal obliga>on) pursuant to Ar>cle 6, c. 1, le\. f) of the GDPR.

4. RetenBon period: 30 days aCer the date of collec>on, unless legal provisions or measures of Public

Authori>es impose a diﬀerent reten>on >me in rela>on to inves>ga>ons related to possible

computer crimes.

5. Provision of personal data: the provision of personal data is mandatory for the pursuit of the

legi>mate interests of the Joint Controllers indicated in the preceding points. Failure to provide it will

result in the impossibility of following up on the User's requests and carrying out the ac>vi>es

indicated above.

b) Filling out the contact form:

1. Purpose of processing: By filling out the forms on the website, Data Subjects may, depending on

specific indica>ons, obtain informa>on about the services provided by the Data Controllers or

request to be contacted.

2. Data processed: mandatory: first name, last name, email. Op>onal free text message and telephone

number.

23. 4. 5. Legal basis: execu>on of the contract for the sale and purchase of products or pre-contractual

measures taken as a result of a request from the Data Subjects pursuant to Ar>cle 6, c.1, le\ b) of

the GDPR.

Storage period: two years from the comple>on of the form.

Provision of personal data: the provision of personal data is op>onal, but necessary to process

Users's requests. Failure to provide the data will result in the impossibility to send the form and thus

to handle Users' requests.

c) RegistraBon to the personal area:

1. Purpose of processing: crea>on of a restricted area ("account") within the UCapital Academy

WebApp that will allow Users to view content regarding their personal posi>on and, in case of

purchasing the annual subscrip>on, access training content included in the UCapital Academy

service.

2. Data processed: personal and contact data indicated in the online form related to the registra>on to

the reserved area (full name, e-mail, password, language). The essen>al data for the use of our

services are marked with an asterisk: therefore, in the absence of the provision of this informa>on

we will not be able to make available the service requested by the User.

3. 4. Legal basis: execu>on of the website registra>on contract pursuant to Art. 6 c. 1 le\. b) of the GDPR.

RetenBon period: the account and data related to it will be deleted 3 years aCer the dele>on of the

account or in case of non-use of the account for more than 3 years. Each User will be able to delete

his or her account directly within the restricted area.

5. Provision of personal data: The provision of personal data is op>onal, but necessary (with regard to

the data defined as mandatory) for the use of our services: in the absence of the provision of this

informa>on, the Joint Controllers will therefore not be able to make available the service requested

by the User, i.e. the crea>on of the personal area.

d) Online purchasing of the service UCapital Academy:

1. Purpose of processing: Fulfillment of purchase orders placed online on the UCapital Academy

WebApp and performance of related ac>vi>es (sending of the confirma>on e-mail, ac>va>on of the

automa>c subscrip>on where the e-mail used for registra>on to the private area is indicated at the

>me of purchase, otherwise ac>va>on of the service within 48 hours, invoicing, management of

payments, possible ac>va>on and management of the process of return and refund of the order,

etc.). Data processed: contact data (first name, last name, e-mail address, phone number, data for

billing purposes). We do not process data related to the means of payment indicated by Users (e.g.,

payment card number and security code), which are instead collected exclusively by the operator of

the chosen payment service.

2. Legal Basis: The processing of such data does not require the consent of the data subjects as it is

necessary for the performance of a contract to which the Data Subject is a party or the execu>on of

pre-contractual measures taken at the request of the same pursuant to Ar>cle 6, c.1, le\ b) of the

GDPR.

3. RetenBon period: >me necessary to fulfill contractual and regulatory obliga>ons regarding the

purchase and sale of products and services (e.g., tax regula>ons), usually equal to 10 years from the

date of purchase.

4. Provision of personal data: The provision of personal data is op>onal, but necessary to manage and

process Users' requests and for the fulfillment of contractual obliga>ons on the part of the Joint

Controllers. Failure to provide the data will result in the inability of the Joint Controllers to fulfill their

contractual obliga>ons.

e) Customer Care:

3f) g) h) 1. Purposes of processing: the Joint Controllers make available to Users a support service contactable

by email by wri>ng to support@academy.ucapital.com, and a whatsapp chat on the website h\ps://

academy.ucapital.com managed directly by UCapital24 S.p.a., for any request related to the purchase

of their products or the use of their services.

2. Data processed: data necessary to respo nd to the requests that will be addressed to Customer Care.

3. Legal basis:

i. execu>on of the contract for the purchase and sale of products or pre-contractual measures

taken as a result of a request from the Data Subjects pursuant to Ar>cle 6, c.1, le\ b) of the

GDPR;

ii. with respect to the chat support service, legi>mate interest in preven>ng so-called "chat

spam" pursuant to Art. 6, c. 1, le\. f) of the GDPR.

4. RetenBon period: >me strictly necessary to fulfill the requests of Data Subjects. Relevant

conversa>ons are deleted weekly and no phone numbers are saved in any way.

5. Provision of personal data: The provision of personal data is op>onal, but necessary to handle and

process Users' requests. Failure to provide the data will result in the inability of the Data Holders to

handle Users' requests.

Sending of commercial communicaBons (for direct markeBng purposes):

1. Purpose of the processing: sending commercial communica>ons via e-mail, SMS, Whatsapp,

Telegram and cell phone regarding products related to the services oﬀered by the Joint Data

Controllers.

2. 3. Data processed: contact data (e.g. first name, last name, e-mail address, telephone number).

Legal basis: the consent of the Data Subjects pursuant to Ar>cle 6, c. 1, le\. a) of the GDPR, which

can be revoked at any >me by wri>ng to privacy@ucapital24.com .

4. 5. RetenBon period: un>l the User revokes consent.

Provision of personal data: the provision of personal data is op>onal. Failure to provide data will not

have any consequence on the usability of the services and remains at the complete discre>on of the

User.

Proximity markeBng (sod spam) for its customers/users:

1. Purpose of processing: for the purpose of sending, by the Joint Controllers, informa>on via email

(not for telephone communica>on) about products and/or services provided by the Joint Controllers

(and not by third par>es) regarding services similar or related to those already purchased or for

which the User has registered or shown interest (so-called "soC spam");

2. 3. Data processed: contact data such as first name, last name, e-mail.

Legal Basis: If the User is already a customer of the Contractors, or has registered for certain services

and there is a balance of interests, the legal basis may consist of the legi>mate interests of the

Contractors (pursuant to Art. 6 c. 1 le\. f) of the GDPR) and therefore consent is not required for

sending adver>sing communica>ons.

4. RetenBon period: for the dura>on of the exis>ng contractual rela>onship with the customer or un>l

the User who has demonstrated interest in a service exercises his or her right to object to the

processing of his or her personal data for marke>ng purposes, and in any case no longer than 3 years

from the >me of data collec>on.

5. Provision of personal data: the provision of data is op>onal. Failure to provide data will have no

consequence on the usability of the services and it remains at the complete discre>on of the User to

decide to object to the processing of their personal data for marke>ng purposes.

Legal obligaBons to which the Co-Processors are subject:

41. 2. 3. 4. 5. Purpose of processing: to fulfill legal obliga>ons to which the Joint Data Controllers are subject (e.g.

accoun>ng, tax, administra>ve);

Data processed: tax and billing data of clients.

Legal basis: the processing is necessary to fulfill a legal obliga>on to which the Joint Controllers are

subject pursuant to Art. 6, c. 1, le\. c) of the GDPR.

RetenBon Period: the Joint Controllers will process the Personal Data of the Data Subjects for the

>me strictly necessary to achieve the purposes indicated in the aforemen>oned purposes.

Provision of Personal Data: the provision of data is mandatory in order to follow up on legal

obliga>ons of the Joint Controllers indicated in the points above. Failure to provide it will result in

the inability of the Joint Controllers to carry out the ac>vi>es indicated above.

i) AnB-fraud and establishment, exercise or defense of a right:

1. Purpose of processing: to verify the correspondence between the acquiring party and the holder of

the selected payment instrument and the establishment, exercise or defense of a right of the Data

Controllers, including in court.

2. Data processed: first name, last name, order details and informa>on on the type of payment

instrument used to make the purchase, more generally, no new and specific provision of Personal

Data is therefore required, as the Joint Controllers will pursue this addi>onal purpose by processing,

where necessary, the Personal Data already collected.

3. Legal basis: legi>mate interest in preven>ng and comba>ng fraud and the exercise or defense of a

right of the Data Controllers under Ar>cle 6(f) of the GDPR.

4. 5. RetenBon period: two years following the collec>on of the data or for the dura>on of any judgment.

Provision of personal data: it is mandatory for the pursuit of the legi>mate interests of the Data

Controllers indicated in the points above. Failure to provide it will result in the impossibility of

carrying out the ac>vi>es indicated above.

4. Device Permissions.

Depending on the specific peripheral device used by the User in the use of the WebApp, the Con>tulars may require

certain permissions to access certain features present on the peripheral device, as described below. Such permissions

must be provided by the User before any ac>on can be taken by the Joint Owners. Following issuance, the permission

may be revoked by the User at any >me. In order to revoke permissions, the User may use the system sebngs or

contact the Owner at the contact details given in this document. The procedure for checking permissions may vary

depending on the device and soCware used by the User. Please consider that revoca>on of one or more permissions

may have consequences on the use of the services oﬀered by the Owner. The required permissions are the following:

“camera” and “photo gallery”.

5. Recipients and possible categories of recipients of personal data.

Personal data may be made accessible to, brought to the a\en>on of, or communicated to the following par>es, who

will be appointed by the Joint Data Controllers, as appropriate, as data processors or authorized persons, or will act as

independent data controllers:

• employees and/or collaborators in any capacity of the Data Controllers;

• suppliers and partners of the Contractors who provide services and all ac>vi>es related to the Site, IT or

marke>ng service providers etc. appointed as data processors, through the signing of a contract;

• freelancers and consultants for the purposes of legal, financial and accoun>ng management of the ac>vi>es

of the Contractors (such as accoun>ng, administra>ve, legal operators etc.) and credit ins>tu>ons and

insurance companies, ac>ng as autonomous data controllers.

• public authori>es or police forces, in cases provided for by law.

It should be noted that Data Subjects's data will be stored in Servers located within the European Union.

56. Transfer of data to countries outside the European Union:

Personal data collected may be transferred outside the European Union. In this case, the transfer will take place in

compliance with the provisions of the EU Regula>on 2016/679 ("GDPR"). In par>cular, data will be transferred only

upon signing Standard Contractual Clauses approved by the EU Commission by Decision No. 2021/914/EU or to

Countries that can guarantee an adequate level of protec>on of personal data and therefore recipients of an Adequacy

Decision adopted by the EU Commission.

In this last regard, please note that the website h\ps://academy.ucapital.com and the WebApp h\ps://

appacademy.ucapital.com currently uses analy>cs cookies from Google Ireland Ltd. Any possible transfers of data to

the United States enjoy the legal basis of Ar>cle 45 of the GDPR, an Adequacy Decision having come into force in July

2023 with respect to the United States which provides for the possibility of transferring data to U.S. companies that

have undergone the required cer>fica>on mechanisms. Google holds all the required and necessary cer>fica>ons in

order to be able to carry out the data transfer in compliance with the applicable regula>ons.

7. Cookies

Cookies are small text files that visited sites send to the User's terminal, where they are stored, and then retransmi\ed

to the same sites on the next visit. Cookies allow sites to func>on properly and eﬃciently to enhance the User's

experience by allowing the from >me to >me relevant site to store informa>on in the memory of the User's computer

or other device.

Cookies can be classified in diﬀerent ways, i.e., depending on the site that generates them, depending on their

dura>on, and depending on their purpose of use.

• Classifica2on of cookies according to the site that generates them:

o First Party Cookies: are generated by the site that the User is visi>ng and only that site can read this

data.

o Third Party Cookies: are generated by other sites, outside of the one the User is visi>ng. When the

User visits a page on a site, he or she may encounter content posted by external sites such as

Facebook, Twi\er, You Tube, Vimeo or others, and those sites may generate cookies. The site

covered by this policy has no control over them. Users are requested to check such sites and their

Privacy Policies.

• Classifica2on of cookies according to their dura2on:

o Temporary (or session) cookies: have no expira>on date, and are deleted as soon as the browsing

session ends or the browser is closed.

o Persistent cookies: have an expira>on date and remain on the computer even when the browsing

session ends or aCer closing the browser. They can be read by the site that created them on

subsequent visits to the same site.

• Classifica2on of cookies according to their purpose of use:

o Technical cookies

o Profiling cookies

o Analysis cookies

In detail combining the classifica2ons we have:

o First-party Technical Cookies: This type of cookie allows certain sec>ons of the Site to func>on

properly. They are of two categories, temporary (or session) and persistent (see above). These

cookies are necessary to properly display the site and in rela>on to the technical services oﬀered,

they will therefore always be used and sent, unless the visitor changes the browser sebngs (with the

6possibility, however, of not taking full advantage or making some services oﬀered by the site

unusable). Technical cookies are those used, for example, to authen>cate, to take advantage of

mul>media content such as flash player or to allow the choice of naviga>on language. In general, it is

not necessary to acquire the User's prior and informed consent. The legal basis for their use is the

legi>mate interest of the Joint Controllers in the smooth opera>on of the website. In addi>on,

analy>cal cookies through which the Joint Controllers learn only sta>s>cal informa>on, collected in

aggregate form, about the number of visitors and how they use the website are also assimilated to

technical cookies. If the informa>on is not collected in aggregate form and instead includes

iden>fying data (e.g., the IP address used by the User's device that has not been anonymized), the

cookies responsible for collec>ng this addi>onal data will be qualified as "profiling cookies," ac>ve

only with the user's consent.

o Technical Cookies to integrate third-party func2ons: This type of cookies integrates func>onality

developed by third par>es within the pages of the site such as icons and preferences expressed in

social networks for the purpose of sharing site content or for the use of third-party soCware services

(such as soCware to generate maps and addi>onal soCware oﬀering addi>onal services). These

cookies are sent from third-party domains and partner sites that oﬀer their func>onality between

the pages of the site.

o Third-party service analy2cs cookies: These cookies are used in order to collect informa>on about

Users' use of the site: pages visited, >me spent on the site, source traﬃc origins, geographic origin,

age, gender and interests for the purpose of marke>ng campaigns. These cookies are sent from

third-party domains external to the site and according to current regula>ons can be assimilated to

technical cookies "if tools are adopted to reduce the power of iden>fica>on and the third party does

not cross-reference the informa>on collected with others it already has" or can be assimilated to

profiling cookies otherwise.

o Profiling cookies: These are those cookies necessary to create User profiles in order to send

adver>sing messages in line with the preferences expressed by the User within the pages of the site.

This type of cookie is not currently opera>ng within the Site in ques>on.

o Social widgets and plug-ins: some widgets and plug-ins made available by social networks may use

their own cookies to facilitate interac>on with the site in ques>on;

Technical cookies do not require the acquisi>on of prior and informed consent from the User for their installa>on. The

legal basis for their use is the legi>mate interest of the Joitn Controllers in the smooth opera>on of the website.

On the other hand, with regard to non-technical cookies, the User's prior consent will be requested at first access.

Without such consent, cookies will not be able to be installed on the User's device, who will be able to manage their

preferences at any >me. Any consent given to the use of cookies is valid for 6 months, aCer which the cookie banner

will be shown again to renew your preferences.

Listed below are, in detail, the cookies installed on the page h\ps://academy.ucapital.com and the webapp h\ps://

appacademy.ucapital.com For each cookie are given the following data: source, cookie name, type, dura>on and

purpose.

List of cookies that require prior consent from the User

Consent is required for the following cookies, without which they will therefore not be installed on Users' devices.

Source Cookie’s Name Tipe of Cookie DuraBon Purpose

7Google Google WPML YouTube YouTube YouTube YouTube YouTube YouTube YouTube _ga_* _ga wp-

wpml_current_lan

guage

yt-remote-device-

id

LAST_RESULT_EN

TRY_KEY

yt-player-headers-

readable

yt-remote-

connected-

devices

yt-remote-

session-app

yt-remote-cast-

installed

yt-remote-cast-

available

Analy>cs 1 year 1 month 4 days Google Analy>cs sets this cookie to

store and count page views.

Analy>cs 1 year 1 month 4 days Google Analy>cs sets this cookie to

calculate visitor, session and

campaign data and track site usage

for the site's analy>cs report. The

c o o k i e s t o r e s i n f o r m a o n

a n o ny m o u s l y a n d a s s i g n s a

randomly generated number to

recognise unique visitors.

Func>onal session WordPress mul>lingual plugin sets

this cookie to store the current

language/language sebngs.

Func>onal Never Expires YouTube sets this cookie to store

the user's video preferences using

embedded YouTube videos.

Func>onal Never Expires y>db::LAST_RESULT_ENTRY_KEY is

used by YouTube to store the last

search result entry that was clicked

by the user. This informa>on is

u s e d t o i m p r o v e t h e u s e r

experience by providing more

relevant search results in the

Func>onal Never Expires future.

yt-player-headers-readable cookie

is used by YouTube to store user

preferences related to video

playback and interface, enhancing

the user's viewing experience.

Func>onal Never Expires YouTube sets this cookie to store

the user's video preferences using

embedded YouTube videos.

Func>onal Dura>on session The yt-remote-session-app cookie

is used by YouTube to store user

preferences and informa>on about

the interface of the embedded

YouTube video player.

Func>onal Session The yt-remote-cast-installed cookie

is used to store the user's video

p l a y e r p r e f e r e n c e s u s i n g

embedded YouTube video.

Cookie.

Func>onal Session The yt-remote-cast-available cookie

is used to store the user's

preferences regarding whether

cas>ng is available on their

YouTube video player.

8YouTube yt-remote-

session-name

Func>onal Session T h e y t- re m o te - s e s s i o n - n a m e

cookie is used by YouTube to store

the user's video player preferences

using embedded YouTube video.

YouTube yt-remote-fast-

check-period

Func>onal Session The yt-remote-fast-check-period

cookie is used by YouTube to store

the user's video player preferences

for embedded YouTube videos.

YouTube YSC Adver>sement Session Youtube sets this cookie to track

the views of embedded videos on

Youtube pages.

YouTube VISITOR_INFO1_LI

VE

Adver>sement 6 months YouTube sets this cookie to

measure bandwidth, determining

whether the user gets the new or

old player interface.

YouTube VISITOR_PRIVACY

_METADATA

Adver>sement 6 months YouTube sets this cookie to store

the user's cookie consent state for

the current domain.

YouTube yt.innertube::requ

ests

Adver>sement Never Expires YouTube sets this cookie to register

a unique ID to store data on what

videos from YouTube the user has

seen.

YouTube yt.innertube::next

Id

Adver>sement Never Expires YouTube sets this cookie to register

a unique ID to store data on what

videos from YouTube the user has

seen.

How to disable cookies by browser configura:on:

In general, Cookies can be disabled by the User by controlling and/or modifying the sebngs of his/her browser

according to the instruc>ons made available by the respec>ve providers at the links provided below:

− MicrosoC Edge

− Mozilla Firefox

− Google Chrome

− Apple Safari

− Opera

More informa>on on cookies is available at h\p://www.youronlinechoices.com/it .

8. Rights of Data Subjects.

The Interested Par>es may exercise the rights that the Gdpr guarantees, as set forth in Ar>cles 7, c. 3, and 15 et seq. by

sending an e-mail to privacy@ucapital24.com , or, alterna>vely, a communica>on by registered le\er with return

receipt to the headquarters of UCapital24 at Via dei Piab 11, 20123, Milan (MI).

The Data Subject may, in par>cular, exercise the following rights:

● Right of access: to obtain confirma>on of the existence or otherwise of the processing of personal data

concerning him/her and the purposes of such processing, to obtain copies of the data and informa>on on: the

origin of the data, the categories of data processed, the recipients of the data, the purposes of processing,

9the existence of automated decision making (including profiling), the period of data reten>on and the rights

provided by the GDPR;

● Right to obtain recBficaBon of inaccurate personal data and supplementa>on of incomplete personal data;

● Right to obtain the deleBon of personal data, if any of the condi>ons set forth in Ar>cle 17 of the GDPR exist,

in cases where the data were no longer necessary or the Joint Data Controllers no longer had the

authoriza>on to process them;

● Right to obtain the limitaBon of the processing of personal data, pursuant to Ar>cle 18 of the GDPR, in the

following cases: 1. if the accuracy of the data is contested, for the >me necessary to verify the accuracy of the

data; 2. In the event that the Joint Data Controllers are no longer authorized to process the data, it is possible

to request the restric>on of the processing alterna>vely to dele>on ; 3. If the data is no longer necessary for

the Joint Data Controllers but is necessary for the data subject for the establishment, exercise or defense of a

right in court;

● Right to data portability, if the condi>ons set forth in Ar>cle 20 of the GDPR are met, i.e., to receive the

personal data concerning him or her in a structured, commonly used and machine-readable format and to

request its transmission to another data controller, if technically feasible;

● Right to revoke consent for processing based on it, without aﬀec>ng the lawfulness of the processing based

on the consent given before revoca>on. Consent can be revoked by wri>ng an e-mail to

privacy@ucapital24.com .

● Right to object to processing in pursuit of the legiBmate interest of the Joint Data Controllers. Each Data

Subject has the right to object at any >me to the processing of his or her personal data carried out in pursuit

of a legi>mate interest of the Joint Data Controllers. In the event of opposi>on, personal data will no longer

be processed, unless there are legi>mate grounds for processing that override the interests, rights and

freedoms of the Data Subject or for the establishment, exercise or defense of a legal claim.

Right to file a complaint with the Guarantor.

Each Data Subject may lodge a complaint with the Guarantor for the Protec>on of Personal Data if he or she believes

that his or her rights under the GDPR have been violated, in the manner indicated on the website of the Guarantor for

the Protec>on of Personal Data.

9. Changes to this policy

This policy may be subject to updates or changes (also due to new legisla>on or regula>ons) for this reason Users are

invited to check this document regularly. Substan>ve changes will in all cases be highlighted via the Site or no>fied by

e-mail.

Date of last revision: 20/05/2024

10